Upload Client Not Connected, seen in the Proxy, with Access Log Upload

Products

• ASG-S200

Issue/Introduction

Upload Client Not Connected, seen in the Proxy, with Access Log Upload. 

Resolution

Investigating the reported challenge with access log upload from the ProxySG, towards the Reporter, which in the deployment, is also the local log source, the eventlog reported that " there is nothing to upload". Further checks revealed the below.

The upload client, which in your deployment, is reported on the ProxySG, as "not connected". Specifically, because no actual connection errors were seen in the eventlog, further investigation into this upload client status, show that the FTP/FTPS user on the Reporter would have been locked out in the past, before the session we had. Whenever this happens, please note that the user account does not get unlocked automatically. To resolve this issue, and also prevent future recurrence, it is recommended to run the CLI command below, on the Reporter.

#authentication disable-user-lockout

With the same FTP server settings, you may repeat the log upload from the Proxy, after the above command is issues.

Note

Even after the log upload resumes, you may still see the upload client status as "not connected". This time, this would only mean that at the time of the current sight, nothing was happening, meaning that Proxy just isn't trying to upload anything nor is it trying to make connection, hence the status. What's important to check, in this situation, on the same status page is that the "Last upload result" shows up as a "success" and not a "failure". Another thing to check would be the "Connect time".

Further investigation, for a used case, confirmed that the issue got resolved after a mismatch with the Protocol > Default log, for HTTP was corrected. The standard is as shown in the snippet below, and as we connected with the customer, we saw that this standard was in place. 

Checks on the Reporter appliance confirmed that logs were being uploaded.